Re: server sending syn to port 53

On Thu, Apr 16, 2009 at 05:23:50PM -0500, Oscar Ricardo Silva wrote:
> We were notified that one of our servers running dnscache were 
> generating a syn attack on a target dns servers.  Sure enough, when we 
> looked we saw that we were sending SYN packets to these servers.  I'm 
> not saying it's dnscache causing this but the pattern appears to be that 
> we send a query and then right afterwards, several SYN packets to the 
> same server.

More information is needed. Please provide the relevant logs.

Chances are, dnscache is trying to open a TCP connection to their
authoritative DNS servers because they are sending a response that is
too large to be sent via UDP. If that is the case, then things are
working as designed -- although it seems silly to publish large DNS
responses, then complain about TCP connections afterwords.